Files
buildroot/package/rust/rust.mk
Nicolas Serafini f1f96c1ad0 package/rust: security bump version to 1.94.1
Note: version 1.94.1 includes security fixes for:
https://www.cve.org/CVERecord?id=CVE-2026-33055
https://www.cve.org/CVERecord?id=CVE-2026-33056

For full change logs, see:
https://blog.rust-lang.org/2026/03/26/1.94.1-release/
https://blog.rust-lang.org/2026/03/05/Rust-1.94.0/
https://blog.rust-lang.org/2026/02/12/Rust-1.93.1/
https://blog.rust-lang.org/2026/01/22/Rust-1.93.0/
https://blog.rust-lang.org/2025/12/11/Rust-1.92.0/
https://blog.rust-lang.org/2025/11/10/Rust-1.91.1/
https://blog.rust-lang.org/2025/10/30/Rust-1.91.0/
https://blog.rust-lang.org/2025/09/18/Rust-1.90.0/
https://blog.rust-lang.org/2025/08/07/Rust-1.89.0/

Since Rust 1.89.0, the bootstrap was redesigned (upstream PR #119899):
the stage 0 standard library is no longer built from source but copied
from the stage 0 compiler's sysroot. This breaks host-rust in two
ways.
https://blog.rust-lang.org/inside-rust/2025/05/29/redesigning-the-initial-bootstrap-sequence/
https://github.com/rust-lang/rust/pull/119899

First, building std from source for a cross target at stage 0 now
requires build.local-rebuild to be set in config.toml. Without it,
the bootstrap refuses to proceed. Set local-rebuild = true since the
stage 0 compiler (host-rust-bin) is the same version as the compiler
being built from source.
https://github.com/rust-lang/rust/pull/145876

Second, host-rust-bin creates relative symlinks to expose the host
std libraries under its rustc component directory. The bootstrap's
copy_link_internal() copies these symlinks verbatim into the
stage0-sysroot, where the relative paths no longer resolve. Replace
them with hardlink copies (cp -al) in HOST_RUST_BIN_LIBSTD_EXTRACT.

Also, Rust received three changes in Cargo's vendoring logic which
produces different vendor directory contents.

In Rust version 1.89:

- cargo vendor now does direct extraction from .crate tarballs
  instead of heuristic file listing, adding previously excluded
  files like .cargo_vcs_info.json and hidden directories:
  https://github.com/rust-lang/cargo/pull/15514

- Files with .rej/.orig suffixes (e.g. Cargo.toml.orig) are no
  longer excluded from vendoring:
  https://github.com/rust-lang/cargo/pull/15569

In Rust version 1.94

- Git-specific files (.gitattributes, .gitignore) are now
  recursively filtered in subdirectories, not just at the top
  level:
  https://github.com/rust-lang/cargo/pull/16439

Therefore the hashes of all Cargo-fetched packages need to be
updated. This commit changes the suffix of Cargo packages from
-cargo4 to -cargo5, and updates all hashes.

Signed-off-by: Nicolas Serafini <nicolas.serafini@flyability.com>
Tested-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Julien:
 - mark commit as "security" and add info in commit log
 - squash version bump, bootstrap and hash fixes in a single commit
 - fix python-cryptography hash after update in commit 632e224184
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-04-13 21:16:49 +02:00

87 lines
2.6 KiB
Makefile

################################################################################
#
# rust
#
################################################################################
# When updating this version, check whether support/download/cargo-post-process
# still generates the same archives.
RUST_VERSION = 1.94.1
RUST_SOURCE = rustc-$(RUST_VERSION)-src.tar.xz
RUST_SITE = https://static.rust-lang.org/dist
RUST_LICENSE = Apache-2.0 or MIT
RUST_LICENSE_FILES = LICENSE-APACHE LICENSE-MIT
RUST_CPE_ID_VENDOR = rust-lang
HOST_RUST_PROVIDES = host-rustc
HOST_RUST_DEPENDENCIES = \
toolchain \
host-pkgconf \
host-python3 \
host-rust-bin \
host-openssl \
host-zlib \
$(BR2_CMAKE_HOST_DEPENDENCY)
HOST_RUST_VERBOSITY = $(if $(VERBOSE),2,0)
define HOST_RUST_CONFIGURE_CMDS
( \
echo '[build]'; \
echo 'target = ["$(RUSTC_TARGET_NAME)"]'; \
echo 'cargo = "$(HOST_RUST_BIN_DIR)/cargo/bin/cargo"'; \
echo 'rustc = "$(HOST_RUST_BIN_DIR)/rustc/bin/rustc"'; \
echo 'python = "$(HOST_DIR)/bin/python$(PYTHON3_VERSION_MAJOR)"'; \
echo 'submodules = false'; \
echo 'vendor = true'; \
echo 'extended = true'; \
echo 'tools = ["cargo"]'; \
echo 'compiler-docs = false'; \
echo 'docs = false'; \
echo 'verbose = $(HOST_RUST_VERBOSITY)'; \
echo 'local-rebuild = true'; \
echo '[install]'; \
echo 'prefix = "$(HOST_DIR)"'; \
echo 'sysconfdir = "$(HOST_DIR)/etc"'; \
echo '[rust]'; \
echo 'channel = "stable"'; \
echo 'musl-root = "$(STAGING_DIR)"' ; \
echo '[target.$(RUSTC_TARGET_NAME)]'; \
echo 'cc = "$(TARGET_CROSS)gcc"'; \
echo '[llvm]'; \
echo 'download-ci-llvm = false'; \
echo 'ninja = false'; \
echo 'ldflags = "$(HOST_LDFLAGS)"'; \
) > $(@D)/config.toml
endef
define HOST_RUST_BUILD_CMDS
cd $(@D); $(HOST_MAKE_ENV) $(HOST_PKG_CARGO_ENV) \
$(HOST_DIR)/bin/python$(PYTHON3_VERSION_MAJOR) x.py build
endef
HOST_RUST_INSTALL_OPTS = \
--prefix=$(HOST_DIR) \
--disable-ldconfig
define HOST_RUST_INSTALL_RUSTC
cd $(@D)/build/tmp/tarball/rust/$(RUSTC_HOST_NAME)/rust-$(RUST_VERSION)-$(RUSTC_HOST_NAME); \
./install.sh $(HOST_RUST_INSTALL_OPTS) --components=rustc,cargo,rust-std-$(RUSTC_HOST_NAME)
endef
ifeq ($(BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS),y)
define HOST_RUST_INSTALL_LIBSTD_TARGET
cd $(@D)/build/tmp/tarball/rust-std/$(RUSTC_TARGET_NAME)/rust-std-$(RUST_VERSION)-$(RUSTC_TARGET_NAME); \
./install.sh $(HOST_RUST_INSTALL_OPTS)
endef
endif
define HOST_RUST_INSTALL_CMDS
cd $(@D); $(HOST_MAKE_ENV) $(HOST_DIR)/bin/python$(PYTHON3_VERSION_MAJOR) x.py dist
$(HOST_RUST_INSTALL_RUSTC)
$(HOST_RUST_INSTALL_LIBSTD_TARGET)
endef
$(eval $(host-generic-package))